Implement enterprise governance and tenant control rules

Objective

Implement governance and tenant-control rules for Azure management hierarchy, policy, RBAC, locks, metadata, provider registration, and configuration drift.

Scope

Implement these controls:

1. A subscription is outside the approved management-group hierarchy.
2. A required security policy initiative is not assigned at the correct scope.
3. A mandatory preventive policy uses Audit instead of an approved enforcement effect.
4. A policy exemption lacks an owner, justification, or expiration date.
5. A critical production resource lacks an approved deletion lock.
6. A subscription has excessive Owner assignments.
7. Privileged access is assigned at an unnecessarily broad scope.
8. A resource provider is registered without a documented operational requirement.
9. A production resource lacks accountable ownership metadata.
10. Security configuration drift remains unresolved beyond the approved SLA.

Collection architecture

• Management-group and subscription hierarchy APIs.
• Azure Policy definitions, initiatives, assignments, exemptions, and effective policy state.
• Authorization role assignments and role-definition APIs.
• Resource locks, Resource Graph inventory, provider registrations, tags, and governance metadata.
• Approved exception and SLA sources.

Required implementation behavior

• Resolve inherited policy and RBAC state before evaluating a child scope.
• Honor valid exemptions, owners, justifications, expiration dates, and documented exceptions.
• Return NOT_APPLICABLE for out-of-scope subscriptions or resources.
• Return UNKNOWN for inaccessible hierarchy, policy, RBAC, lock, tag, or provider evidence.
• Return FAIL only when effective unsafe configuration is confirmed.
• Include effective scope, inherited assignment, exception state, evidence, remediation, permissions, severity, confidence, and UNKNOWN reason.

Delivery order

1. Hierarchy, policy assignment, enforcement, and exemption rules.
2. Locks, Owner assignments, and broad privileged-scope rules.
3. Provider registration, ownership metadata, and drift rules.

Acceptance criteria

• Tests cover inheritance, conflicting assignments, valid and expired exemptions, scope boundaries, RBAC inheritance, locks, deleted resources, tags, provider state, API errors, and permission failures.
• Valid parent controls and active exemptions do not create false findings.
• Every rule has documentation, remediation, tests, and verified mappings without TBD.
• Scanner, compliance, and CI-equivalent tests pass.
• An origin-branch PR references this issue.